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ICO’s consultation on its guidance for the use of 
personal data in political campaigning 
Summary of responses and ICO comments 


In September 2019 the ICO published its consultation on its draft 
framework code of practice for the use of personal data in political 
campaigning which has now become final guidance for the use of personal 
data in political campaigning. 


As part of this we asked a number of questions (see Annex A). 


Our questions asked for views on our draft guidance. Overall we received 
11 formal responses, broken down as follows: 


e Data subjects - 5 

e Associations/Societies - 3 

e Business/commercial enterprises — 1 
e Academics - 1 

e Other - 1 


In addition workshops were held with political parties, civil society groups, 
other regulators/bodies including the Electoral Commission, Market 
Research Society and Centre for Data Ethics and Innovation. 


Respondents welcomed the introduction of new guidance, highlighting the 
changing landscape of political campaigning and the need for the 
guidance to fully reflect the law as it currently stands. Response to the 
draft was largely positive and the draft has now been revised to take into 
account feedback provided. We thank all consultees involved for their 
contribution. 


Whilst we cannot respond to each submission in detail we have provided 
an analysis of the key points raised, and some comment throughout on 
where and how these have been addressed. 


Key points 


e Examples needed to ‘show their working’ 
The workshops with both the political parties and civil society groups 
revealed an appetite for further detail to be provided in the examples 
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explaining the reasoning or ‘workings’ behind the conclusion that 
activities outlined in the examples were lawful or not. 


ICO comment 

We agreed with this point. Examples in the guidance have been 
reworked to provide more detail of the rationale behind them ie 
‘showing the working’. 


Not enough reference to other related sector codes and 
guidance 

It was noted that the framework did not reference the Electoral 
Commission (EC) guidance on the use of the electoral register. The EC 
guidance outlines usage restrictions in more detail, including the 
disposal of the electoral register. It was also argued that it would be 
useful for the framework to refer to other sector codes and guidance, 
such as the Market Research Society’s (MRS) Code of Conduct. This 
would demonstrate that other professions and sectors have concerns 
about political campaigning. 


ICO comment 

The guidance refers readers to the Electoral Commission for further 
information on electoral law. Following consultation with the Electoral 
Commission further links and information have been added. The ICO is 
however, responsible for the regulation of data protection and 
electronic marketing laws so it would be inappropriate to provide 
detailed information on electoral law as part of this guidance. 


We agreed that the Market Research Society Code of Conduct is useful 
to refer to and have done so. 


The different types of public opinion research should be further 
clarified 

The guidance should be expanded to further clarify and specify the 
scope of activities carried out as public opinion research and those 
carried out as direct marketing and how they overlap in political 
campaigning. 


ICO comment 

We agreed that this area needed some improvement. The section 
related to direct marketing has been expanded and following 
consultation with the Market Research Society further detail has been 
included about the differences between public opinion research and 
political campaigning. 


e Covering of specific technologies 
The majority of respondents felt that the framework code covered the 
right political campaigning activities, however one respondent 
suggested that combination tactics such as cross channel promotion 
based on hashed data should be covered. 


ICO comment 

Various new technologies are now forming part of the political 
campaigning landscape. The guidance discusses the use of new 
technologies and methods more generally and how campaigners should 
consider their compliance with data protection law. This means that the 
type of technology being used should not affect the applicability of the 
guidance. 


e Example relating to purpose limitation introduces an arbitrary 
barrier 
We received responses suggesting that the original example used to 
describe the purpose limitation principle would have a chilling effect on 
local campaigning practices — in particular the use of surveys. It was 
argued that the guidance was creating an arbitrary barrier through this 
example and that an example of a petition would be more appropriate 
in demonstrating an incompatible purpose. 


ICO comment 

We agreed with the point made. The example was not intended to 
create any barriers where none exist so the example has been made 
more clear cut by reframing it as a campaigner using petition data 
rather than data collected via a survey. Detail has been changed to 
make it clear that this is an incompatible purpose - for example - no 


2021/03/09 3 


2021/03/09 


privacy information having been provided, the subject matter being 
completely different etc. This change should allay concerns of an 
arbitrary barrier being introduced. 


Examples relating to profiling were not relevant to UK 

Some respondents expressed concern with the examples in the 
guidance demonstrating where profiling could have a legal or ‘similarly 
significant effect’ on an individual. In particular there was concern with 
an international example involving a political party deliberately 
targeting members of a minority group and encouraging them not to 
vote (voter suppression). They argued that there was no evidence of 
any such activities in the UK but that by including them it insinuated 
that there was or that such behaviour was likely. 


ICO comment 

The examples were intended to be extreme to demonstrate that the 
bar for a ‘similarly significant effect’ in political campaigning was very 
high. An international example was used as there were no suitable UK 
examples that met the bar. However, on reflection there is a strong 
argument that examples included in guidance should only reflect the 
circumstances in the jurisdiction in which it applies to. The first 
example in particular, by raising the possibility of voter suppression, 
could be seen as casting doubt on the health of the UK’s democratic 
system. The chapter includes a series of questions a political party or 
others should ask themselves to determine whether the processing 
would have ‘a legal or similarly significant effect’. We think this is 
sufficient to demonstrate the point without the need to include 
examples so they have now been removed. 


There should be a section in the guidance relating to individual 
rights 

Some respondents suggested there should be a section within the 
guidance discussing individual rights including subject access as this is 
an area missing from the guidance. 


ICO comment 

Although we agree that individual rights and in particular the right of 
access is fundamental to data protection law, we have not included a 
section on this within the guidance. The guidance is focused on political 
Campaigning activity specifically. Subject access does not form part of 
political campaigning activities in the same way that collecting personal 
data does for example. We do, however, agree that it is important for 
such guidance to be available to political campaigners. The ICO Guide 
to Data Protection includes detailed guidance relating to the right of 
access. We will also further consider whether specific guidance on the 
right of access for organisations carrying out political campaigning 
activities is desirable. 
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Annex A 

ICO consultation on the draft framework code of 
practice for the use of personal data in political 
campaigning 


It is vital in any democratic society that political parties, candidates and 
campaigners are able to communicate effectively with voters. But it is 
equally vital that all organisations involved in political campaigning use 
personal data in a way that is transparent, understood by people and 
lawful. 


Our current guidance on political campaigning is outdated. It has not been 
updated since the introduction of the GDPR and does not reflect modern 
campaigning practices. We have therefore drafted and are now consulting 
on a new framework code of practice for the use of personal data in 
political campaigning. This will serve both as helpful guidance in its own 
right as well as having the potential to become a statutory code of 
practice if the relevant legislation is introduced. 


The framework code of practice does not introduce new requirements for 
Campaigners but seeks to explain and clarify data protection and 
electronic marketing laws as they already stand. It also seeks to provide 
practical guidance and useful examples on ways campaigners could 
comply with their obligations whilst carrying out common political 
Campaigning activities. 


Before drafting the framework code of practice, the ICO launched a call 
for views in October 2018. You can view a summary of the responses and 
some of the individual responses on our website. The responses have 
helped inform the content of the draft framework code. 


We welcome views on the draft framework code of practice. Please send 
us your responses by Friday 4 October 2019. 


Privacy statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
capacity (eg a member of the public). All responses from organisations 
and individuals responding in a professional capacity will be published. We 
will remove email addresses and telephone numbers from these 
responses; but apart from this, we will publish them in full. 
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For more information about what we do with personal data please see our 
privacy notice. 


Questions 


Qi Does the draft framework code adequately explain and advise on 
the aspects of data protection and electronic marketing laws which 
are relevant to political campaigning? 


O Yes 
O No 


Q2 If not, please specify where improvements could be made. 


Q3 Does the draft framework code contain the right level of detail? 


O Yes 
O No 


Q4 Ifno, in what areas should there be more detail within the draft 
framework code? 
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Q5 Does the draft framework code provide enough clarity on the law 
and good practice on the use of personal data for political 
campaigning? 


O Yes 
O No 


Q6 If no, please indicate the section(s) of the draft framework code 
which could be improved, and what can be done to make the 
section(s) clearer. 


Q7 Does the draft framework code cover the right political campaigning 
activities? 


O Yes 
O No 


Q8 If no, what other activities would you like to be covered in it? 


Q9 Does the draft framework code appropriately recognise and 
understand the ways in which political campaigning takes place in 
practice in the online world? 


O Yes 
O No 
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Q10 If no, in what way does the draft framework code fail to recognise 
and understand this? 


Qiii Does the draft framework code provide examples relevant to your 
organisation? 


O Yes 
O No 


Q12 Please provide any further comments or suggestions you may have 
about examples in the draft framework code. 


Q13 To what extent do you agree that the draft framework code is clear 
and easy to understand? 


Strongly agree 

Agree 

Neither agree nor disagree 
Disagree 

Strongly disagree 


OO 


Q14 Are you answering as: 


O An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the public) 

O An individual acting in a professional capacity 

O On behalf of an organisation 


2021/03/09 9 


O Other 


Please specify the name of your organisation: 


Thank you for taking the time to share your views. 
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